Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I there a way to get information on which operating system a site is running?

I need to find sites whose server has Linux installed.

Is what I'm asking feasible through Google?

Thanks a lot

share|improve this question

closed as not a real question by Shane Madden, mulaz, Zoredache, ewwhite, faker Dec 25 '12 at 21:53

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

nmap -O can give you some information... but chances are that any major production website you'll hit these days will be behind a hardware or software load balancer, so that result may not be valid.

Can you give more detail or context in what you're trying to do?

share|improve this answer
Beside i am quite sure running nmap on other networks apart from yours without permission, is an offence. At least it is, where I reside from. – Soham Chakraborty Dec 25 '12 at 18:48

Well, there are couple of ways on finding this info.

If you want to find out specifically which version of flavor of Linux OS it is running, then you need to do a host scan using nmap with -O options, but host/port scan is something which anyone can detect and I don't think you would like to run a port scan on few machines of a data center.

The other way is to use the feature of default TTL of operating systems.

So, every OS have their own TTL, and when you ping them, they reply with their TTL values.

When you ping a machine, then you see an output like this

64 bytes from icmp_seq=0 ttl=48 time=396.306 ms
64 bytes from icmp_seq=1 ttl=48 time=324.736 ms

Just look at the TTL value. Over here it is 48. Now running a traceroute can easily tell you that there are 16 hops in between you and the server. Simply add both the values. This means that the server TTL is 64, which is the default TTL for most of the Linux machines.

You can check the default TTLs for different OS's over here.

So, you can simply write a small script, which can ping a server, check the TTL, and then traceroute to see the number of HOPS and then add up the values.

nmap method is something which will take time, but the information given will be precise in most of the cases, but there will be cases where nmap will be blocked and you won't be able to ping the OS

ping method will be real quick but the information will be a little bit not perfect. ping is normally open on most of the servers.

Hope this helped.

share|improve this answer
Thanks a lot for your explanation.Perhaps I didn't ask my question correctly. I know that by using nmap -O I can roughly get information about the OS a site is running..also your method of inference works quite well..but my question is: without knowing of a site whose server is running on Linux how can I find one? i mean I cannot resort to a trial and error method it would be time consuming...thanks – g9999 Dec 25 '12 at 22:22
Ohhh ... not really have a good idea of that :( – GeekRide Dec 26 '12 at 5:20

I know of a way that works and is easy but doesn't work always. The way is use the non existant page. So the website would return 404. If it was apache then in the footer (if the site ops haven't disabled) , it would show apache version and OS. If it was IIS then 404 would show a IIS-ish error message (Again if the site ops haven't disbaled it).

share|improve this answer

Netcraft confirms it.

Or is that meme a /. thing only?

Netcraft has a tool on their website for your question.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.